The European Union has assumed that one of the great challenges for the coming years will be to secure a starting position in the race of the technological revolution. After achieving leadership in the regulation of Artificial Intelligence, the time has come for this to be capable of becoming a driver of community competitiveness. The debate now focuses on how to facilitate the growth of this type of tools on the continent, with an eye cast sideways at other rivals such as the United States or China.
Recently, and after multiple delays in its negotiation, the Twenty-Seven reached an agreement to reform the General Data Protection Regulation (GDPR). It was one of the last loose ends that still remained open of the so-called digital omnibus, the simplification package with which the European Commission intended to put an end to all the obstacles that were preventing this sector from taking off on a European scale. After several discussions at technical levels, and some failed attempts to raise the dossiers to higher diplomatic levels, the member states agreed to simplify the requirements for the use of users' sensitive information during the training of digital tools when "its legitimate interest" can be established.
All this, on the eve of the first meeting that will bring together European heads of government around the challenges of these technologies within two weeks in Dublin. In this context, the secretary general of the European Data Protection Supervisor (EDPS), Leonardo Cervera (1970), gives an extensive interview from his office to DEMÓCRATA.
From his responsibility in the body in charge of ensuring compliance with data protection rules in European institutions, Cervera participates in one of the control mechanisms that accompany the community legislative process: the issuing of opinions and recommendations to ensure that new initiatives respect citizens' fundamental rights. His position allows him to observe from within how the balance between the demands of innovation and privacy guarantees is articulated. A balance that, he warns, still poses important challenges: "Big tech can afford for it to be more profitable to pay a fine than to comply with the law".
Question: The Council has just approved its position on the modifications to the GDPR, to what extent do they respond to a real need for legal certainty and to what extent can they mean a reduction in guarantees for citizens?
Answer: I think that any regulation that affects technological issues needs to be updated regularly. It is well known that the laws that apply to the technological field have a hard time, because technology advances so quickly that legislation is always behind.
This initiative is more of a facelift, a technical update, like the ones that are downloaded for Windows, not a substantive reform. We are not dealing with a modification that really affects the rights of citizens. Its fundamental objective is simplification, not so much deregulation. There are many people who would like the European Union to deregulate, but the EU opts to simplify and facilitate the work of those who legally apply the rules.
Q: The latest compromise text contemplates resorting to legitimate interest to process personal data during the development and training of artificial intelligence systems. What limits should be established to prevent this legal basis from becoming a generalized way to use personal information without consent?
A. The best thing is to refer to the joint opinion of the European Data Protection Supervisor and the European Data Protection Board, which revolves precisely around the figure of legitimate interest. Both bodies consider that it can be a valid legal basis, but subject to a series of conditions and safeguards that are specified in that opinion.
I believe that data protection regulations must have a liberal approach that allows the needs of companies and technology to be addressed, but with a series of red lines and safeguards that prevent abuses by operators. The regulations have two souls: one protective and another business-oriented.
Leonardo Cervera:"There are companies that are so powerful that they can afford not to comply with the regulations"
P. You were talking about red lines. Where should the legislator place them?
R. In matters of data protection, the red lines have been known for a long time. The main one is respect for the dignity of the individual. It is a very old principle, although, evidently, it is subject to interpretation. When data processing fails to respect the citizen, whether because their information is used in a way they could not reasonably expect or because it is used in ways that violate their dignity, we are faced with a red line.
Over time, digital regulation has evolved from relatively abstract declarations of principles and rights toward more concrete rules. The GDPR does not have that risk-based approach so clearly developed, in part because it is a regulation that is already around ten years old.
P. Are you concerned that the accumulation of regulatory simplification initiatives in the digital sphere could end up weakening the coherence of the European data protection framework?
R. If it is genuine simplification, it does not concern me; quite the opposite. I am one hundred percent in favor of simplifying.
I had a boss who used to say that what cannot be explained in twenty minutes perhaps should not be explained. One must be clear and concise. The same happens with laws. In my personal opinion, the GDPR, the Artificial Intelligence Act, and other European rules are excessively long and cumbersome. Simplifying is always positive and it should be done even more, especially for small and medium-sized enterprises. When the risks are not high, the liberal approach should carry more weight than the protective one.
Moreover, Europe has an advantage: it has a deeply rooted data protection culture. Ten or fifteen years ago that could not have been said, but today both governments and organizations have internalized that culture and know that there are certain things that cannot be done. As a rule, they respect them.
For that reason, I do not think we need excessively detailed or stringent legislation in all areas. Simplification can help maintain effective protection without imposing unnecessary burdens.
Leonardo Cervera:"The EU has to get companies to comply without citizens having to keep filing complaints"
Q. To bring it down to a concrete example, how should a developer act if they detect that data relating to health, political opinions or ethnic origin have been incorporated into an artificial intelligence model during its training and removing them afterward proves technically unfeasible or disproportionate?
A. That developer will normally be working in an organization, not out of the garage at home. In that organization there should be a data protection officer —Data Protection Officer or DPO— or someone responsible for what I call responsible technology, a concept that also includes artificial intelligence.
In practical terms, if a developer detects something that raises doubts for them, what they must do is bring it to the attention of the DPO. This person, thanks to the independence granted by their role, will be able to determine whether there is a problem and, if so, raise it to the organization’s management.
The European data protection system is intelligent because it does not require prior authorization to start working with personal data. Organizations can do so, but the principle of proactive accountability means that, when they detect something that does not fit, they must turn to the DPO, the legal services or whoever is appropriate to check whether their action complies with the regulations.
In major artificial intelligence development processes, a data protection impact assessment is usually carried out. This analysis must be done at the beginning of development. If things are done well, there should be no later surprises: the possible problems should have been identified beforehand.
Q. What oversight mechanisms would make it possible to verify that companies are really applying the principles of data minimization, instead of merely formally complying with their obligations?
A. This works a bit like the police. You cannot have an officer on every corner or at every door to check that everyone obeys the law. It is assumed that people respect the rules.
I use this analogy because it helps to understand the role of supervisory authorities in the digital world. The starting point is liberal: no one needs prior authorization to work with personal data. However, companies know their obligations and must keep the necessary documentation in case a complaint is filed or an authority decides to investigate on its own initiative.
This mechanism works reasonably well. Any user can file a complaint before the Spanish Data Protection Agency, for example. If the authority investigates and discovers that the company does not have the required documentation, it may face significant fines.
Leonardo Cervera:"European data protection regulations need to be simplified, especially for SMEs"
Q: This also applies to the technological giants. Sometimes it feels like the fines are pocket change.
A: The problem lies with certain actors, especially the large technology platforms. They have so much power and so many resources that they can afford to take the risk that, at a certain point, it will be more profitable for them to pay a fine than to fully comply with the regulations. They can also calculate that the reputational damage will be manageable.
For 99% of operators, the system established by law works. Where we must reflect as a society and as a democracy is on how to ensure that that 1%, especially now in the field of large artificial intelligence companies, also complies. For those actors, ordinary mechanisms may not be enough.
Q. Changing the subject, how does the European Data Protection Supervisor intervene in practice when it detects that a European legislative proposal may affect privacy?
A. European regulations are based on a system of checks and balances. The General Data Protection Regulation applies in the member states, but there is also specific, very similar, regulation for the institutions and bodies of the European Union. Our regulation establishes that, when a legislative proposal affects people's privacy and data protection, the European Commission is obliged to consult the European Data Protection Supervisor. The Commission is aware of this obligation.
The duty to consult does not mean that the legislator is obliged to apply our recommendations, but it does mean that it must request our opinion. In most cases, this procedure is complied with. We are consulted before the proposal advances in the legislative process, so that the text of the Commission is usually accompanied by the opinion of the European Data Protection Supervisor.
It is a mechanism that usually works quite well. We receive many consultations: there are years in which we exceed one hundred and even two hundred.
Leonardo Cervera:"The concentration of power and money in artificial intelligence is unprecedented in the history of humanity"
Q. In the digital omnibus file, are the Supervisor's recommendations being taken into account?
A. As a general rule, almost all our recommendations and those of the European Data Protection Board have been taken into account. I think we are satisfied with the treatment we have been given.
Q. And what happens when a proposal departs from your criteria? What room does the Supervisor have to react?
A. It is part of democracy and we have to accept it. Sometimes, the legislator does not share the Supervisor's opinion. Data protection is only one of the many interests at stake in any legislative file. If the legislator considers that other interests should prevail, it is perfectly legitimate to do so.
Now then, it is a fundamental right enshrined in the Charter of Fundamental Rights of the European Union and, moreover, it is a right that matters to European citizens. That is why, normally, it cannot be completely ignored. Sometimes we are listened to more and other times less, but we must accept that the legislator makes its own decisions, as happens in any democracy.
Q. Returning to artificial intelligence, to what extent can European citizens today exercise their rights of access, rectification and deletion when their data have already been used to train artificial intelligence models?
R. European citizens enjoy a level of protection practically unmatched in the world. It is the highest and most rigorous data protection model that exists. Any citizen who has the slightest suspicion that their data is not being handled correctly can go to a data protection authority, either that of their country or that of the place where the processing is taking place.
There is a great deal of flexibility and you have the right for that authority to examine your complaint and issue a resolution. That is the starting point. However, I do not think it is fair for the enforcement of rights to fall on citizens.
A person should not have to sacrifice their weekends to read hundred-page privacy policies, check what companies do with their data, file complaints with the authorities and then respond to the other party’s lawyers. It cannot work like that. It is companies that must comply with the law without citizens having to constantly insist that their rights be respected.
As we move forward in digital development, we must pay more attention to companies fulfilling their obligations. There is a very important power imbalance. That is why we need an effective supervision and compliance system, one that creates the necessary incentives for companies to respect the law without each citizen having to file a complaint.
Leonardo Cervera:"The citizen should not have to sacrifice their time to defend their digital rights"
Q. To what extent is the European Union prepared to effectively supervise the development of increasingly complex artificial intelligence models?
R. The European Union is doing things well. Another issue is that the current geopolitical context and the enormous concentration of power and money in the artificial intelligence sector pose an extraordinary challenge. We are facing a concentration of resources and capacity for influence unprecedented in the history of humanity.
It is an undeniable challenge, but I think we must give a vote of confidence. Not only do we have pioneering regulations, but we have also invested in governance structures and mechanisms to ensure that Europe continues to be a space in which citizens are respected when their data are processed by artificial intelligence systems.
OFF the record
The recorder is turned off, but Cervera still has something to teach. Before saying goodbye, he takes out some of the books he has written about Bernardo de Gálvez, the Spanish military man who played a decisive role in the independence of the United States. The talk leaves for a moment the European regulations, the algorithms and data protection to travel to another chapter of the shared history between both sides of the Atlantic.
Between the pages of those books appears a lesser-known facet of the one who, from Brussels, devotes much of his time to thinking about Europe’s technological and legal challenges. Cervera pauses on some details of the work and leaves open the possibility of continuing the conversation another day, this time with Gálvez as the protagonist.
New talks and a few episodes of history to discover therefore remain pending. Because not all conversations that begin by talking about the digital future have to end in front of a screen.